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Abstract  —  Blakley,  Blakley,  Chan  and  Massey 
conjectured  a  lower  bound  on  the  entropy  of  public 
broadcast  in  a  threshold  scheme  with  disenrollment 
capability.  In  this  paper,  we  first  show  that  the  con¬ 
jecture  need  not  be  true  in  general.  Then  we  estab¬ 
lish  a  tight  lower  bound  on  the  entropy  of  public  in¬ 
formation  by  introducing  one  property  to  the  defini¬ 
tion  of  threshold  schemes  with  disenrollment.  We  also 
present  a  scheme  that  achieves  the  lower  bound. 

Keywords:  secret  sharing,  threshold  schemes 

I.  Introduction 

A  ( t ,  n)  threshold  scheme  allows  a  secret  to  be  distributed 
among  a  group  of  n  participants  in  such  a  way  that  t  or  more 
participants  can  construct  the  secret  by  pooling  their  shares, 
but  the  secret  remains  undetermined  to  (t  —  1)  or  fewer  par¬ 
ticipants.  Threshold  schemes  are  useful  in  applications  that 
require  the  shared  control  of  a  secret  among  multiple  parties, 
for  example,  threshold  encryption  and  signature.  They  also 
find  direct  application  when  protection  against  the  loss  of  sev¬ 
eral  shares  is  needed,  for  example,  file  sharing. 

Shamir  [9]  and  Blakley  [2]  have  introduced  and  con¬ 
structed  threshold  schemes  independently.  Since  then,  thresh¬ 
old  schemes  have  been  generalized  to  secret  sharing  schemes 
and  attracted  a  great  amount  of  research  attention.  An  ex¬ 
cellent  survey  on  secret  sharing  can  be  found  in  [10],  and  a 
bibliography  is  provided  online  in  [11].  Martin  [7]  consid¬ 
ered  the  problem  of  managing  a  secret  sharing  scheme  when 
a  participant  becomes  untrustworthy.  When  a  member  is  no 
longer  trustworthy,  the  share  held  by  that  participant  has  to 
be  assumed  disclosed.  The  disclosure  or  the  loss  of  one  share 
decreases  the  threshold  size  t  by  1,  because  (t—  1)  shares  plus 
the  disclosed  share  can  decrypt  the  secret.  To  keep  the  same 
level  of  secrecy  in  terms  of  threshold  size,  new  shares  have  to 
be  constructed,  and  the  shared  secret  among  the  group  has  to 
be  updated.  The  property  of  maintaining  the  same  threshold 
in  case  of  loss  or  disclosure  of  shares  is  known  as  disenrollment 
capability. 

Blakley,  Blakley,  Chan,  and  Massey  [3]  are  the  first  group 
who  defined  the  disenrollment  capability.  In  their  model,  the 
shares  of  a  threshold  scheme  are  issued  securely  by  a  trusted 
third  party,  dealer,  to  participants  on  initialization.  They  con¬ 
sidered  threshold  schemes  that  allow  disenrolling  L  members, 
one  at  a  time,  through  an  insecure  public  channel.  They  de¬ 
rived  a  lower  bound  on  the  size  of  the  shares  held  by  each  par¬ 
ticipant  in  such  a  scheme.  A  conjecture  on  the  lower  bound 
of  the  public  broadcast  size  was  also  proposed.  In  this  paper, 
we  will  address  the  conjecture. 

The  paper  is  organized  as  follows:  in  section  II,  we  review 
the  definition  of  threshold  schemes  with  disenrollment  capa- 
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bility  in  an  information  theoretic  approach  given  by  [3].  We 
provide  a  different  approach  to  establish  the  lower  bound  on 
the  size  of  the  shares.  In  section  III,  we  show  by  two  exam¬ 
ples  that  the  conjecture  on  the  entropy  of  broadcast  messages 
need  not  be  valid.  In  section  IV,  we  derive  a  lower  bound  on 
the  size  of  broadcast  messages  by  adding  one  property  to  the 
definition.  We  also  give  a  construction  that  achieves  the  lower 
bound.  Main  contributions  of  this  paper  are  summarized  in 
section  V. 

II.  Threshold  Schemes  with  Disenrollment 
Capability 

In  this  section,  we  review  and  revise  the  definition  of  thresh¬ 
old  schemes  with  disenrollment  given  in  [3],  by  noting  that 
the  original  definition  is  incomplete.  We  also  present  an  al¬ 
ternative  approach  to  establish  the  lower  bound  on  the  share 
entropy.  For  consistency  and  ease  of  understanding,  we  will 
use  the  same  notations  as  those  in  the  original  paper.  H(-) 
indicates  Shannon  entropy  [6]. 

Definition  1  A  (t,n)  threshold  scheme  is  a  sharing  of  a  se¬ 
cret  K  among  n  participants,  and  participant  j  (1  <  j  <  n) 
holds  share  Sj,  so  that  for  any  set  of  k  indices  {fi,  I2, ...,  Ik} 

H(K\Sh,Sh,...,Sik)  =  0  for  t<k<n  (1) 

H(K\Sh,Sh,...,Slk)  >  0  for  k<t.  (2) 

In  a  (t,  n)  threshold  scheme,  the  secret  K  is  recoverable 
from  t  or  more  shares  based  on  condition  (1),  but  the  secret 
remains  uncertain  even  with  the  knowledge  of  (t  —  1)  shares 
according  to  (2)  .  The  secret  K  and  the  shares  Sj  take  values 
in  the  secret  space  K,  and  the  shares  space  S,  respectively.  If 
(t—  1)  or  fewer  shares  reveal  absolutely  no  information  on  the 
secret  K ,  then  the  threshold  scheme  is  said  to  be  perfect  in 
Shannon  information  theoretic  sense. 

A  (t,  n)  threshold  scheme  is  called  perfect  provided  that 

H(K\Sh,Si2,...,Slk)  =  H(K)  for  k  <  t.  (3) 

It  has  been  shown  in  [8]  that  a  necessary  condition  to  have  a 
perfect  threshold  scheme  is 

H{Sj)  >  H(K)  for  j  =  1, 2, ...,  n.  (4) 

A  perfect  threshold  scheme  is  called  ideal  if  the  scheme  can 
achieve  the  lower  bound  in  (4),  i.e.,  H(Sj)  =  H(K)  for  all  j. 

A  (t,  11)  threshold  scheme  with  L-fold  disenrollment  capa¬ 
bility  defined  in  [3]  is  (i)  initially  (i.e.,  at  stage  i  =  0)  a  (t,  n) 
threshold  scheme  that  shares  a  secret  Kq  among  n  partici¬ 
pants  (ii)  able  to  disenroll  a  member  at  each  update  stage 
i  (i  =  1,2 ,...,L)  by  updating  the  shared  secret  K,-\  to  Ki 
through  a  broadcast  message  Pi.  Let  Sj  denote  the  share 
held  by  participant  j  over  the  entire  L  up  dates.  Without  loss 
of  generality,  Blakley  et  al  assume  that  participant  i  is  disen- 
rolled  at  the  ith  disenrollment  and  Si  corresponds  to  the  share 
that  is  invalidated  at  the  ith  update. 
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Definition  2  A  ( t ,  n)  threshold  scheme  with  L-fold  disenroll- 
ment  capability  with  n  —  L  >  t  is  a  collection  of  shares  Sj  for 
j  =  1,2 ,..,n,  shared  secrets  Ki  for  i  =  0, !,...,  L,  and  pub¬ 
lic  broadcast  messges  Pi  for  l  =  1,2 ,...,L,  that  satisfies  the 
following  conditions: 

H(Ki\Ai(k),  Pi,  =  0 

for  t  <  k  <  n  —  i  (5) 
H(Ki\Ai(k),  Pi, ...,  Pi,  Si, ...,  Si,  K0, ...,  Ki-i)  >  0 

for  k  <  t,  (6) 

where  A i(k)  =  {Si17...,Sik}  C  {Sj+i, ...,  Sn}  with  k  <n  —  i. 
That  is,  Ai(fc)  is  any  set  of  k  remaining  valid  shares  at  the 
ith  disenrollment  step. 

Condition  (5)  requires  that  the  key  K,  can  be  solved  by 
at  least  t  shares  from  valid  participants  and  broadcast  mes¬ 
sages  Pi,...,  Pi.  Condition  (6)  states  that,  given  all  broadcast 
information  Pi,...,  Pi,  all  disenrolled  shares  Si,...,  Si  and  all 
past  keys  Kq,  ...,Ki-i,  the  secret  key  Aj  is  still  unsolvable  if 
the  number  of  shares  available  is  less  than  t.  Note  that  con¬ 
dition  (6)  is  different  from  the  original  definition  in  [3] ,  which 
gave  the  condition  as 

H(Ki\Ai(k),  Pi, ...,  Pi,  Si, ...,  Si)  >  0  for  k  <  t  (7) 

Condition  (6)  is  stronger  than  the  original  condition  (7)  be¬ 
cause  (6)  requires  ( t  —  1)  shares  plus  all  disenrolled  shares  are 
not  sufficient  to  determine  the  new  key  Ki  even  if  all  the  pre¬ 
vious  secrets  Kq,  ..,  A;_i  are  given.  The  reason  we  use  (6) 
instead  of  (7)  is  that  Blundo  [4]  has  shown  that  the  stronger 
condition  (6)  is  necessary  in  deriving  a  lower  bound  on  the 
entropy  of  the  shares  obtained  in  [3],  and  also  it  is  a  necessary 
condition  to  prove  Lemma  5  in  [3]. 

A  ( t ,  n)  threshold  scheme  with  L-fold  capability  is  said  to 
be  perfect  if 

H{Ki\Ai(k),Pi,...,Pi,  Si, ...,  Si,  K0, ...,  Kt- 1)  =  H(Ki) 

for  k  <  t.  (8) 

From  Definition  2,  a  threshold  scheme  with  disenrollment 
capability  at  stage  i  is  equivalent  to  a  (t,n  —  i )  threshold 
scheme  sharing  Ki  among  n  —  i  valid  participants.  Each  par¬ 
ticipant  must  have  a  component  in  his  share  corresponding 
to  Ki.  Let  S'-1'1  denote  the  component  held  by  participant  j 
corresponding  to  K, ,  and  we  call  a  subshare  of  participant 
j.  Sj  can  be  regarded  as  the  union  of  all  its  subshares  over 
L  disenrollment  stages,  i.e. ,  Sj  =  {S^°\  S^\  ...,  SjL)}.  We 
establish  the  independence  of  all  the  subshares  held  by  one 
participant  in  the  following  lemma. 

Lemma  1  In  a  perfect  ( t ,  n)  threshold  scheme  with  In¬ 
fold  disenrollment  capability,  subshares  of  participant  j, 
Sj°  ,  SjT\  ■■.,  SjL^  are  independent. 

Proof:  First  we  prove  that  the  secrets  AYs  for  i  =  0, 1,  ...,L 
are  independent,  i.e., 

L 

H{K0,Ki,...,Kl)  =^H{Ki). 

i= 0 


H(K0,KU...,KL) 

L 

=  H{K0)  +  J2  H(Ki\I<0, ...,  Ki-i) 

i= 1 

>  H(K0)  +  H(Ki\I<0, ...,  Ki-i,  Pi, Pi,  Si,...,  Si,  A  4(fc)) 

i= 1 

(=>  J2H(K')-  (10) 

i=0 

Equality  (a)  holds  because  of  chain  rule,  and  inequality  (b) 
holds  from  the  fact  that  conditioning  reduces  entropy.  Equal¬ 
ity  (c)  is  obtained  from  (8).  From  a  known  property  of  the 
entropy,  we  have 

L 

H(Ko,  Ki, ...,  I<l)  <^H{Ki).  (11) 

i=0 

From  (10)  and  (11),  we  can  obtain  (9),  i.e.,  the  secrets  AYs 

are  independent. 

(i) 

Subshares  Sf  are  derived  from  A,  for  i  =  0 ,...,L.  Since 
the  functions  of  independent  random  variables  are  inde¬ 
pendent,  the  independence  between  subshares  S^  for  i  = 

0, 1,...,L  thus  follows.  I 

One  major  contribution  of  [3]  is  to  establish  a  lower  bound 
on  the  entropy  of  each  share  in  a  threshold  scheme  with  disen¬ 
rollment  capability.  The  contribution  is  summarized  in  Theo¬ 
rem  1. 

Theorem  1  Let  Si, ...,  Sn,  Pi,  Pl,  Kq,  ...,  Kl  form  a  per¬ 
fect  threshold  scheme  with  L-fold  disenrollment  capability  and 
H(Ki)  =  m  for  i  =  0,1, ...,  L.  Then, 

H(Sj)>(L+l)m  for  j  =  l,2,...,n.  (12) 

On  the  observation  that  .Sj  can  be  regarded  as  the  union  of 
all  its  L  +  1  subshares,  we  provide  an  alternative  and  simpler 
proof  to  Theorem  1. 

Proof:  we  notice  that  the  necessary  condition  in  (4)  can  be 
extended  to  the  size  of  subshares,  i.e.,  we  have 

H{Sf)>H(Ki)  for  *  =  0, 1, ...,  L;  j  =  l,...,n.  (13) 


H(Sj)  =  H(Sj°\Sj1\  ...,  SjL^) 

= 

i= 0 
L 

>  ^A(Ai)  =  (L+l)m. 

i= 0 

The  second  equality  follows  from  Lemma  1.  S 

III.  Conjecture  and  Counterexamples 

We  now  present  and  analyze  the  main  conjecture  on  the  lower 
bound  for  the  entropy  of  public  information  in  [3]. 

Conjecture  1  A  lower  bound  on  the  entropy  of  the  broadcast 
message  Pi  at  the  ith  disenrollment  for  i  ■  1, ...,  L  is 

H(Pi)  >  iH(K)  =  im. 


Then, 


(9) 


In  the  following,  we  show  the  size  of  broadcast  informa¬ 
tion  can  be  different  from  that  given  in  the  conjecture  by  two 
examples  [7], [3]. 

•  In  [7],  Martin  noticed  that  a  ( t ,  n)  threshold  scheme  can 
be  constructed  from  a  (t  +  L,  n)  threshold  scheme  by 
publishing  L  additional  shares.  In  Martin’s  threshold 
scheme  with  disenrollment  capability,  the  share  held  by 
participant  j  is  of  the  form 

c  _  r  o(°)  ct1)  q(T)i 

°3  —  J  Jj  !  •■•5  Jj  S' 

where  is  a  share  of  a  ( t+L ,  n )  ideal  perfect  threshold 

scheme.  At  update  stage  i,  i  members  have  been  disen- 
rollcd  and  their  shares  become  public  knowledge.  In  ad¬ 
dition  to  the  disclosed  i  shares,  L  —  i  dummy  shares  are 
needed  to  be  broadcasted  so  that  with  t  shares  collected 
from  the  group,  the  secret  can  be  recovered.  Therefore, 
the  public  message  at  stage  i  is  the  union  of  dummy 
shares  as 

p  r  cP)  cU)  cb)  \ 

—  i  *-,d1  >  0d2  ’  °d.L_i  f ' 

The  subscript  d  indicates  that  the  shares  are  dummy 
shares,  the  superscript  i  indicates  that  they  are  for  re¬ 
covering  Ki . 

Claim  1  In  Martin’s  perfect  threshold  scheme  with  L- 
fold  disenrollment  capability,  the  broadcast  message  in 
the  ith  update  phase  contains  ( L  —  i)H(Ki)  =  (L  —  i)m 
bits  for  i  =  0, ...,  L. 

The  size  of  public  messages  in  Martin’s  scheme  linearly 
decreases  with  update  stage  i.  This  is  an  example  that 
does  not  agree  with  the  conjecture  in  [3].  To  illus¬ 
trate  the  difference,  we  consider  the  broadcast  message 
at  stage  L.  In  Martin’s  scheme,  there  is  no  message 
published;  but  according  to  Conjecture  1,  the  length  of 
broadcast  message  should  be  at  least  Lm. 

•  In  Brickell-Stinson’s  scheme  [3],  the  share  held  by  par¬ 
ticipant  j  is 

Sj  ={sf\Rf\...,R\L)}. 


where  R',-  '  denotes  encryption/decryption  key  for  par¬ 
ticipant  j  at  disenrollment  stage  i  and  it  is  a  random 
number  of  the  same  size  as  the  shared  key  A,.  At  the 
ith  disenrollment,  only  ( n  —  i )  valid  participants  need  to 
be  refreshed  with  new  subshares.  The  dealer  selects  a 
new  key  Ki,  generates  the  new  subshares  S ^  for  legal 
members  using  a  ( t ,  n )  perfect  ideal  threshold  scheme, 
and  publishes  the  encrypted  version  of  new  subshares 
as  Sj ^  .  The  broadcast  message  Pi  is  of  the  form 


Pi  =  {S, 


b)  i  pb)  pb)  I  pb) 

i+ 1  “V  -H-i+l:  Ji+ 2  "r  ni+2’ 


b)i 


For  Brickell-Stinson’s  scheme,  Rf  with  j  =  1,2,  ...,n 
are  chosen  independently,  and  we  can  claim  the  follow¬ 
ing. 

Claim  2  In  Brickell-Stinson’s  perfect  threshold  scheme 
with  L-fold  disenrollment  capability, 

H{Pi)  =  (n-  i)H(Ki)  =  (n  —  i)m  i  =  1, ...,  L. 


The  entropy  of  public  information  in  Brickell-Stinson’s 
scheme  is  decreasing  with  the  stage  i,  and  this  violates 
Conjecture  1  that  states  the  lower  bound  of  broadcast 
entropy  linearly  increases  with  stage. 


IV.  Lower  Bound  on  Broadcast  Entropy 

Having  shown  that  the  lower  bound  in  Conjecture  1  need 
not  hold  in  general,  we  now  show  that  according  to  Defini¬ 
tion  2  in  [3],  it  is  possible  to  construct  a  threshold  scheme  with 
disenrollment  that  requires  no  public  broadcast.  We  also  add 
a  “correction”  condition  that  will  require  a  broadcast  message 
at  the  time  of  disenrollment. 

A  model  satisfying  Definition  2  that  requires  no 
public  broadcast:  let  us  consider  the  following  scheme.  Par¬ 
ticipant  j  holds  the  share  Sj  =  {Sj°\  SjL\  S^L)}  after  ini¬ 
tialization,  where  subshare  S ^  corresponds  to  a  share  of  a 
(t  +  i,n)  threshold  scheme  sharing  the  secret  A';.  At  stage  i,  i 
subshares  of  disenrolled  members  plus  t  shares  from  the  valid 
remaining  participants  are  sufficient  to  decrypt  Ki.  There¬ 
fore,  there  is  no  need  for  broadcast  information  and  the  size 
of  public,  information  is  zero  in  this  scheme.  However,  the 
scheme  is  problematic.  If  all  members  collaborate  by  exchang¬ 
ing  their  shares,  all  members  will  decipher  all  Kf's  at  once  and 
the  disenrollment  of  any  invalidated  member  is  not  under  the 
control  of  dealer.  In  contrast,  in  Martin’s  scheme  and  Brickell- 
Stinson’s  scheme,  broadcast  P,  plays  a  role  in  reconstructing 
the  secret  Ki  and  hence  the  disenrollment  involving  update 
K,  _  i  to  Ki  at  stage  i  is  not  possible  without  a  broadcast 
message  from  the  dealer. 

The  scheme  presented  above  satisfies  Definition  2  while  re¬ 
quiring  no  broadcast.  In  order  for  the  dealer  to  have  the  con¬ 
trol  over  disenrollment  at  any  stage,  we  suggest  adding  the 
following  condition  to  make  the  definition  complete:  1 

/(Ai;S'i,52,...,5„,Pi,...,P-i)  =  0  for  i  =  0,...L.  (14) 

where  /(•)  denotes  mutual  information  [6].  Condition  (14) 
states  that  the  mutual  information  of  K,  and  all  shares  Sj  for 
j  =  1  ...n  and  all  previous  broadcast  message  Pi,  P2, ...,  Pi- 1  is 
zero.  It  expresses  the  importance  of  broadcast  message  Pi  at 
stage  i:  without  the  message,  no  information  on  the  new  key 
can  be  obtained  even  if  all  shares  Sj  and  all  previous  broadcast 
message  Pi,P2,  ...,P;_i  are  known. 

With  condition  (14),  the  lower  bound  on  the  entropy  of 
public  information  can  be  derived. 

Theorem  2  Let  Si, ...,  Sn,  Pi, Pl,  A'o,  ...,  Ki  form  a  per¬ 
fect  threshold  scheme  with  L-fold  disenrollment  capability  sat¬ 
isfying  properties  (5),  (6)and  (14),  and  H(Ki)  —  m  for 
i  =  0, 1, ...,  L,  then 

H(Pi)  >  H(Ki)  =  m  j  =  1, L.  (15) 

Proof: 

(“) 


H(Pi)  > 

H(PilS1,...,Sn,P1,...,Pi-1) 

(6) 

> 

H(Pi\Su...,  5n,Pi,...,Pi_i) 

-H(Pi\Si,...,Sn,Pi,...Pi-i,Ki) 

.(c) 

I(Pi\  Ki\Sl,  ...,  Sn,Pl,  ...,  Pi-l) 

(d) 

H(Ki\Si, ...,  S„,  Pi, ...,  Pj_i) 

-H(I<i\Si,...,Sn,Pi,...,Pi-i,Pi 

(e) 

H(Ki\Si, ...,  S„,  Pi, ...,  Pi-i) 

1  Barwick  et  al  also  addressed  the  conjecture  in  [1],  but  they 
did  not  add  the  constraint  that  requires  public  broadcast  at  each 
disenrollment. 


=  H(Ki)  -  I(Kt ;  Si,  S2,  ....  Sn,  Pi,...,  Pi- 1) 

=  ff(Jfi)  =  m. 

Inequality  (a)  comes  from  the  fact  conditioning  reduces  en¬ 
tropy,  inequality  (b)  holds  due  to  nonnegativity  of  entropy, 
equalities  (c)  and  (d)  follow  from  the  definition  of  mutual 
information.  The  second  term  of  (d)  is  zero  due  to  (5),  so 
equality  (e)  follows.  Equality  (g)  holds  from  property  (14).  I 
Inequality  (15)  shows  that  the  entropy  of  a  broadcast  mes¬ 
sage  is  at  least  that  of  the  shared  key  for  all  updates. 

Now  we  present  a  threshold  scheme  with  disenrollment  that 
is  revised  from  Blundo’s  dynamic  threshold  scheme  [5].  The 
difference  between  dynamic  threshold  schemes  and  threshold 
schemes  with  disenrollment  capability  is  that  dynamic  thresh¬ 
old  schemes  do  not  consider  disenrollment  of  participants  but 
updates  of  the  shared  secret  only. 

•  On  initialization:  given  the  keys  K,  with  i  =  0,...,L 
to  be  shared,  the  dealer  randomly  chooses  strings  7?,  of 
length  m  =  H(Ki),  computes  all  subshares  Sj  with 
j  =  1  and  distributes  Sj  to  participant  j,  where 
Sj^  is  a  share  of  a  (t  +  i,  n )  perfect  ideal  threshold 
scheme  sharing  K,  +  Rt. 

•  At  update  i,  the  dealer  broadcasts  Ri,  i.e.,  Pi  =  Ri.  A 
set  of  t  shares  from  valid  participants  plus  i  disclosed 
shares  suffices  to  recover  K,  +  Ri  and  thus  to  decipher 
K,  on  receiving  Ri. 

Claim  3  The  proposed  perfect  threshold  scheme  with  L-fold 
disenrollment  capability  achieves  the  lower  bound  on  share  en¬ 
tropy  in  (12)  and  the  lower  bound  on  the  entropy  of  broadcast 
in  (15),  i.e., 

H(Sj)  =  (L  +  l)H(Ki)  =  (L  +  l)m, 

H(Pi)  =  H(Ki)  =  m. 

We  have  been  assuming  that  the  disenrolled  shares  become 
known  to  all  remaining  members.  But  if  untrustworthy  mem¬ 
bers  do  not  reveal  their  shares  to  the  public,  the  dealer  needs 
to  publish  these  shares  in  addition  to  R, ,  and  the  broadcast 
message  at  stage  i  becomes 

p  _  r p  old  ob)  ob)\ 

—  yrti,  >3 1  ,  C>2  ,  •••,  Pj  /• 

It  is  easy  to  verify  that  Pi  contains  exactly  (i  +  l)H(Ki)  = 
(■ i  +  l)m  bits.  Namely,  the  size  of  broadcast  information  is 
directly  proportional  to  stage  i.  In  this  case,  the  size  of  the 
broadcast  message  is  close  to  Conjecture  1. 

V.  Conclusions 

In  this  paper,  we  addressed  a  conjecture  posed  in  [3]  regard¬ 
ing  the  lower  bound  on  the  broadcast  entropy  for  threshold 
schemes  with  disenrollment.  We  presented  two  counterexam¬ 
ples  to  show  the  conjecture  does  not  hold.  We  identified  in¬ 
completeness  in  the  definition  of  threshold  schemes  with  disen¬ 
rollment  in  [3]  and  presented  a  correction  term  which  ensures 
that  the  public  broadcast  from  the  dealer  is  required  for  dis- 
enrollment.  We  then  derived  the  correct  lower  bound  on  the 
broadcast  entropy. 
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